v4.1.0-rc.4

Pre-release v4.1.0-rc.4

Target release: v4.1.0 (minor bump)
Branch: staging
Commit: d375386

Commits since v4.0.0

• feat(benchmarks): external routable proxy URLs, multi-cluster fleet filtering, and target validation (#216)
• fix(benchmarks): auto-drain and dispatch pending runs on agent ws connect (#209)
• fix(bnk): resolve staging regressions from v4 migration (#228)
• Merge pull request #207 from f5devcentral/feat/azure-auth-templates
• Merge pull request #219 from f5devcentral/fix/benchmark-target-cluster-uniqueness
• Merge pull request #222 from f5devcentral/fix/gitpython-3.1.60
• security: bump PyJWT to 2.15.0, urllib3 to 2.8.0 and axios to 1.20.0
• Merge branch 'work/v4-localhost' into feat/azure-auth-templates
• fix(frontend): force BNK data refetch after builder apply
• Merge branch 'work/v4-localhost' into feat/azure-auth-templates
• fix(frontend): module-first cluster detection, targeted BNK force refresh
• fix(backend): keep route serviceSettings in topology responses; always clear CWC caches after resync
• fix(auth): keep Entra ID SSO templates out of provisioning defaults
• Merge branch 'work/v4-localhost' into feat/azure-auth-templates
• Merge branch 'fix/benchmark-target-cluster-uniqueness' into work/v4-localhost
• Merge branch 'fix/gitpython-3.1.60' into work/v4-localhost
• Merge branch 'fix/gitpython-3.1.60' into fix/benchmark-target-cluster-uniqueness
• security: bump gitpython to 3.1.60
• chore(migrations): renumber Azure credential template migration to v2_159
• Merge branch 'work/v4-localhost' into feat/azure-auth-templates
• chore(migrations): renumber cluster discovery migrations after v2_156
• Merge branch 'fix/benchmark-target-cluster-uniqueness' into work/v4-localhost
• fix(k8s): signal a missing bound template with a reason code
• fix(frontend): cluster detection confirm, BNK cache keys, per-cluster placeholders
• fix(auth): scope Azure credentials to the chosen auth method
• fix(backend): BNK data pipeline, credential discovery and cache correctness
• fix(benchmarks): include cluster id in target picker labels
• fix(migrations): v2_156 downgrade restores unique ix_benchmark_targets_name
• chore(api): update openapi.json and generated typescript types
• fix(benchmarks): scope target name uniqueness to cluster and add name filter
• fix(auth): update openapi spec and frontend api types for azure auth method
• fix(auth): address review findings for azure auth templates
• fix(#207): self-review — tz-naive expiry crash, drop token-leaking SSO routes, doc SSO/terraform split
• fix(auth): deduplicate 24-hour credential expiry notification and align alembic docstring
• fix(auth): set migration revision to v2_156 for independent branch on staging
• fix(auth): rebase migration to v2_157 and harden azure sso token refresh
• feat(auth): add Microsoft Azure Service Principal and Entra ID SSO credential templates
• fix(frontend): fail closed when blueprint template load errors in deploy dialog
• fix(#205 r*): assert kubeconfig encryption-at-rest (M1) + normalize Azure api_server (M3)
• fix(fleet): remove unused re import
• refactor(bnk): consolidate bnk version extraction and coordinate query invalidation
• fix(system): isolate thread db sessions in bnk consumption and harden ca bundle
• fix(ci): suppress upstream CVE-2026-56854 in bundled Go binaries
• perf: optimize F5 BNK diagnostics data caching and cross-tab navigation
• perf(k8s,f5bnk,fleet): eliminate blocking spinners and redundant fetches across tab navigation
• feat(system): add node capacity fallback for bnk resources and polish deploy dialog
• feat(f5bnk): show per-listener connection counters in Traffic Flow
• perf(bnk): cache shared BNK state across tabs, diagnostics, and license endpoints; fix project-switch refresh
• test(f5bnk): return real cluster from mocked KubernetesService.get_cluster
• feat(k8s): expose cluster metadata fields end-to-end
• perf(bnk): cap thread pools and cache expensive cloud/BNK/license work
• fix(f5bnk): evaluate BNK 2.3 policy refs, route parent conditions, and CNE available state
• perf(system): parallelize bnk-consumption cluster collection with 30s timeout
• perf(f5bnk): stop blocking health dashboard on unified data; skip configview probes when no VS rows
• fix(module-library): honor git_ref tag refs and reconcile official source with settings
• feat: support custom TLS CA certificates for corporate SSL inspection proxies
• feat: add operational-state polish to App Delivery (Slice 7)
• feat: add TMM traffic stats to BNK gateway/listener/egress views
• refactor: relocate BNK Resources, MCP, and Benchmarks navigation
• feat: add BNK Resources fleet consumption dashboard to System page
• feat: credential-template-driven cluster auto-detection
• feat: BNK Health dashboard connectivity and integration status
• refactor: DRY operator connectivity, node enrichment, and region selector
• feat: enrich BNK Health dashboard with node/AZ placement metadata
• feat: allow free-form cloud regions and add cluster discovery metadata
• Merge pull request #208 from f5devcentral/feat/unified-cloud-k8s-access
• Merge pull request #203 from f5devcentral/fix/202-multus-openshift-namespace
• security(deps): bump js-yaml 4.3.1 -> 4.3.2 (P4 Security Audit npm HIGH)
• security(deps): bump gitpython 3.1.58 -> 3.1.59 (P4 Security Audit gate)
• security(trivy): suppress CVE-2026-56854 (x/crypto/ssh) until helm 3.22.0 stable
• Merge pull request #215 from f5devcentral/security/trivyignore-cve-2026-56854
• security(deps): bump js-yaml 4.3.1 -> 4.3.2 (P4 Security Audit npm HIGH)
• security(deps): bump gitpython 3.1.58 -> 3.1.59 (P4 Security Audit gate)
• security(trivy): suppress CVE-2026-56854 (x/crypto/ssh) until helm 3.22.0 stable
• fix(#208): fail closed on mismatched credential template + self-review nits
• fix(#202 review r1): shared ranked Multus DaemonSet picker; file the class follow-ups
• fix(k8s): load kubeconfig purely in-memory and isolate project credential templates
• fix(k8s): correct AKS AAD server app id and extract multi-cloud badge utilities
• fix(frontend): sync version to 4.0.0 in package-lock.json for npm audit
• chore(deps): bump GitPython to 3.1.59, mcp urllib3, and ignore CVE-2026-56854
• fix(deps): pin urllib3>=2.6.4 to remediate CVE-2026-21441
• chore(security): allowlist microsoft public azure cli client id in gitleaks
• fix(backend,frontend): fix boolean filter syntax and design tokens
• feat(frontend): add multi-cloud provider badges and flags for gke and azure
• fix(k8s): retry cloud OAuth token minting on corporate proxy SSL interception
• feat(k8s): support pure-Python GCP and Azure OAuth token generation with fallback
• fix(#202): deterministic Multus DaemonSet selection + document the pod-count scope (self-review)
• fix(#202): count Multus pods in the DaemonSet's namespace so OpenShift reports correctly

v4.1.0-rc.3

Pre-release v4.1.0-rc.3

Target release: v4.1.0 (minor bump)
Branch: staging
Commit: 7b2e805

Commits since v4.0.0

• fix(benchmarks): auto-drain and dispatch pending runs on agent ws connect (#209)
• fix(bnk): resolve staging regressions from v4 migration (#228)
• Merge pull request #207 from f5devcentral/feat/azure-auth-templates
• Merge pull request #219 from f5devcentral/fix/benchmark-target-cluster-uniqueness
• Merge pull request #222 from f5devcentral/fix/gitpython-3.1.60
• security: bump PyJWT to 2.15.0, urllib3 to 2.8.0 and axios to 1.20.0
• Merge branch 'work/v4-localhost' into feat/azure-auth-templates
• fix(frontend): force BNK data refetch after builder apply
• Merge branch 'work/v4-localhost' into feat/azure-auth-templates
• fix(frontend): module-first cluster detection, targeted BNK force refresh
• fix(backend): keep route serviceSettings in topology responses; always clear CWC caches after resync
• fix(auth): keep Entra ID SSO templates out of provisioning defaults
• Merge branch 'work/v4-localhost' into feat/azure-auth-templates
• Merge branch 'fix/benchmark-target-cluster-uniqueness' into work/v4-localhost
• Merge branch 'fix/gitpython-3.1.60' into work/v4-localhost
• Merge branch 'fix/gitpython-3.1.60' into fix/benchmark-target-cluster-uniqueness
• security: bump gitpython to 3.1.60
• chore(migrations): renumber Azure credential template migration to v2_159
• Merge branch 'work/v4-localhost' into feat/azure-auth-templates
• chore(migrations): renumber cluster discovery migrations after v2_156
• Merge branch 'fix/benchmark-target-cluster-uniqueness' into work/v4-localhost
• fix(k8s): signal a missing bound template with a reason code
• fix(frontend): cluster detection confirm, BNK cache keys, per-cluster placeholders
• fix(auth): scope Azure credentials to the chosen auth method
• fix(backend): BNK data pipeline, credential discovery and cache correctness
• fix(benchmarks): include cluster id in target picker labels
• fix(migrations): v2_156 downgrade restores unique ix_benchmark_targets_name
• chore(api): update openapi.json and generated typescript types
• fix(benchmarks): scope target name uniqueness to cluster and add name filter
• fix(auth): update openapi spec and frontend api types for azure auth method
• fix(auth): address review findings for azure auth templates
• fix(#207): self-review — tz-naive expiry crash, drop token-leaking SSO routes, doc SSO/terraform split
• fix(auth): deduplicate 24-hour credential expiry notification and align alembic docstring
• fix(auth): set migration revision to v2_156 for independent branch on staging
• fix(auth): rebase migration to v2_157 and harden azure sso token refresh
• feat(auth): add Microsoft Azure Service Principal and Entra ID SSO credential templates
• fix(frontend): fail closed when blueprint template load errors in deploy dialog
• fix(#205 r*): assert kubeconfig encryption-at-rest (M1) + normalize Azure api_server (M3)
• fix(fleet): remove unused re import
• refactor(bnk): consolidate bnk version extraction and coordinate query invalidation
• fix(system): isolate thread db sessions in bnk consumption and harden ca bundle
• fix(ci): suppress upstream CVE-2026-56854 in bundled Go binaries
• perf: optimize F5 BNK diagnostics data caching and cross-tab navigation
• perf(k8s,f5bnk,fleet): eliminate blocking spinners and redundant fetches across tab navigation
• feat(system): add node capacity fallback for bnk resources and polish deploy dialog
• feat(f5bnk): show per-listener connection counters in Traffic Flow
• perf(bnk): cache shared BNK state across tabs, diagnostics, and license endpoints; fix project-switch refresh
• test(f5bnk): return real cluster from mocked KubernetesService.get_cluster
• feat(k8s): expose cluster metadata fields end-to-end
• perf(bnk): cap thread pools and cache expensive cloud/BNK/license work
• fix(f5bnk): evaluate BNK 2.3 policy refs, route parent conditions, and CNE available state
• perf(system): parallelize bnk-consumption cluster collection with 30s timeout
• perf(f5bnk): stop blocking health dashboard on unified data; skip configview probes when no VS rows
• fix(module-library): honor git_ref tag refs and reconcile official source with settings
• feat: support custom TLS CA certificates for corporate SSL inspection proxies
• feat: add operational-state polish to App Delivery (Slice 7)
• feat: add TMM traffic stats to BNK gateway/listener/egress views
• refactor: relocate BNK Resources, MCP, and Benchmarks navigation
• feat: add BNK Resources fleet consumption dashboard to System page
• feat: credential-template-driven cluster auto-detection
• feat: BNK Health dashboard connectivity and integration status
• refactor: DRY operator connectivity, node enrichment, and region selector
• feat: enrich BNK Health dashboard with node/AZ placement metadata
• feat: allow free-form cloud regions and add cluster discovery metadata
• Merge pull request #208 from f5devcentral/feat/unified-cloud-k8s-access
• Merge pull request #203 from f5devcentral/fix/202-multus-openshift-namespace
• security(deps): bump js-yaml 4.3.1 -> 4.3.2 (P4 Security Audit npm HIGH)
• security(deps): bump gitpython 3.1.58 -> 3.1.59 (P4 Security Audit gate)
• security(trivy): suppress CVE-2026-56854 (x/crypto/ssh) until helm 3.22.0 stable
• Merge pull request #215 from f5devcentral/security/trivyignore-cve-2026-56854
• security(deps): bump js-yaml 4.3.1 -> 4.3.2 (P4 Security Audit npm HIGH)
• security(deps): bump gitpython 3.1.58 -> 3.1.59 (P4 Security Audit gate)
• security(trivy): suppress CVE-2026-56854 (x/crypto/ssh) until helm 3.22.0 stable
• fix(#208): fail closed on mismatched credential template + self-review nits
• fix(#202 review r1): shared ranked Multus DaemonSet picker; file the class follow-ups
• fix(k8s): load kubeconfig purely in-memory and isolate project credential templates
• fix(k8s): correct AKS AAD server app id and extract multi-cloud badge utilities
• fix(frontend): sync version to 4.0.0 in package-lock.json for npm audit
• chore(deps): bump GitPython to 3.1.59, mcp urllib3, and ignore CVE-2026-56854
• fix(deps): pin urllib3>=2.6.4 to remediate CVE-2026-21441
• chore(security): allowlist microsoft public azure cli client id in gitleaks
• fix(backend,frontend): fix boolean filter syntax and design tokens
• feat(frontend): add multi-cloud provider badges and flags for gke and azure
• fix(k8s): retry cloud OAuth token minting on corporate proxy SSL interception
• feat(k8s): support pure-Python GCP and Azure OAuth token generation with fallback
• fix(#202): deterministic Multus DaemonSet selection + document the pod-count scope (self-review)
• fix(#202): count Multus pods in the DaemonSet's namespace so OpenShift reports correctly

v4.1.0-rc.2

Pre-release v4.1.0-rc.2

Target release: v4.1.0 (minor bump)
Branch: staging
Commit: c92423f

Commits since v4.0.0

• fix(bnk): resolve staging regressions from v4 migration (#228)
• Merge pull request #207 from f5devcentral/feat/azure-auth-templates
• Merge pull request #219 from f5devcentral/fix/benchmark-target-cluster-uniqueness
• Merge pull request #222 from f5devcentral/fix/gitpython-3.1.60
• security: bump PyJWT to 2.15.0, urllib3 to 2.8.0 and axios to 1.20.0
• Merge branch 'work/v4-localhost' into feat/azure-auth-templates
• fix(frontend): force BNK data refetch after builder apply
• Merge branch 'work/v4-localhost' into feat/azure-auth-templates
• fix(frontend): module-first cluster detection, targeted BNK force refresh
• fix(backend): keep route serviceSettings in topology responses; always clear CWC caches after resync
• fix(auth): keep Entra ID SSO templates out of provisioning defaults
• Merge branch 'work/v4-localhost' into feat/azure-auth-templates
• Merge branch 'fix/benchmark-target-cluster-uniqueness' into work/v4-localhost
• Merge branch 'fix/gitpython-3.1.60' into work/v4-localhost
• Merge branch 'fix/gitpython-3.1.60' into fix/benchmark-target-cluster-uniqueness
• security: bump gitpython to 3.1.60
• chore(migrations): renumber Azure credential template migration to v2_159
• Merge branch 'work/v4-localhost' into feat/azure-auth-templates
• chore(migrations): renumber cluster discovery migrations after v2_156
• Merge branch 'fix/benchmark-target-cluster-uniqueness' into work/v4-localhost
• fix(k8s): signal a missing bound template with a reason code
• fix(frontend): cluster detection confirm, BNK cache keys, per-cluster placeholders
• fix(auth): scope Azure credentials to the chosen auth method
• fix(backend): BNK data pipeline, credential discovery and cache correctness
• fix(benchmarks): include cluster id in target picker labels
• fix(migrations): v2_156 downgrade restores unique ix_benchmark_targets_name
• chore(api): update openapi.json and generated typescript types
• fix(benchmarks): scope target name uniqueness to cluster and add name filter
• fix(auth): update openapi spec and frontend api types for azure auth method
• fix(auth): address review findings for azure auth templates
• fix(#207): self-review — tz-naive expiry crash, drop token-leaking SSO routes, doc SSO/terraform split
• fix(auth): deduplicate 24-hour credential expiry notification and align alembic docstring
• fix(auth): set migration revision to v2_156 for independent branch on staging
• fix(auth): rebase migration to v2_157 and harden azure sso token refresh
• feat(auth): add Microsoft Azure Service Principal and Entra ID SSO credential templates
• fix(frontend): fail closed when blueprint template load errors in deploy dialog
• fix(#205 r*): assert kubeconfig encryption-at-rest (M1) + normalize Azure api_server (M3)
• fix(fleet): remove unused re import
• refactor(bnk): consolidate bnk version extraction and coordinate query invalidation
• fix(system): isolate thread db sessions in bnk consumption and harden ca bundle
• fix(ci): suppress upstream CVE-2026-56854 in bundled Go binaries
• perf: optimize F5 BNK diagnostics data caching and cross-tab navigation
• perf(k8s,f5bnk,fleet): eliminate blocking spinners and redundant fetches across tab navigation
• feat(system): add node capacity fallback for bnk resources and polish deploy dialog
• feat(f5bnk): show per-listener connection counters in Traffic Flow
• perf(bnk): cache shared BNK state across tabs, diagnostics, and license endpoints; fix project-switch refresh
• test(f5bnk): return real cluster from mocked KubernetesService.get_cluster
• feat(k8s): expose cluster metadata fields end-to-end
• perf(bnk): cap thread pools and cache expensive cloud/BNK/license work
• fix(f5bnk): evaluate BNK 2.3 policy refs, route parent conditions, and CNE available state
• perf(system): parallelize bnk-consumption cluster collection with 30s timeout
• perf(f5bnk): stop blocking health dashboard on unified data; skip configview probes when no VS rows
• fix(module-library): honor git_ref tag refs and reconcile official source with settings
• feat: support custom TLS CA certificates for corporate SSL inspection proxies
• feat: add operational-state polish to App Delivery (Slice 7)
• feat: add TMM traffic stats to BNK gateway/listener/egress views
• refactor: relocate BNK Resources, MCP, and Benchmarks navigation
• feat: add BNK Resources fleet consumption dashboard to System page
• feat: credential-template-driven cluster auto-detection
• feat: BNK Health dashboard connectivity and integration status
• refactor: DRY operator connectivity, node enrichment, and region selector
• feat: enrich BNK Health dashboard with node/AZ placement metadata
• feat: allow free-form cloud regions and add cluster discovery metadata
• Merge pull request #208 from f5devcentral/feat/unified-cloud-k8s-access
• Merge pull request #203 from f5devcentral/fix/202-multus-openshift-namespace
• security(deps): bump js-yaml 4.3.1 -> 4.3.2 (P4 Security Audit npm HIGH)
• security(deps): bump gitpython 3.1.58 -> 3.1.59 (P4 Security Audit gate)
• security(trivy): suppress CVE-2026-56854 (x/crypto/ssh) until helm 3.22.0 stable
• Merge pull request #215 from f5devcentral/security/trivyignore-cve-2026-56854
• security(deps): bump js-yaml 4.3.1 -> 4.3.2 (P4 Security Audit npm HIGH)
• security(deps): bump gitpython 3.1.58 -> 3.1.59 (P4 Security Audit gate)
• security(trivy): suppress CVE-2026-56854 (x/crypto/ssh) until helm 3.22.0 stable
• fix(#208): fail closed on mismatched credential template + self-review nits
• fix(#202 review r1): shared ranked Multus DaemonSet picker; file the class follow-ups
• fix(k8s): load kubeconfig purely in-memory and isolate project credential templates
• fix(k8s): correct AKS AAD server app id and extract multi-cloud badge utilities
• fix(frontend): sync version to 4.0.0 in package-lock.json for npm audit
• chore(deps): bump GitPython to 3.1.59, mcp urllib3, and ignore CVE-2026-56854
• fix(deps): pin urllib3>=2.6.4 to remediate CVE-2026-21441
• chore(security): allowlist microsoft public azure cli client id in gitleaks
• fix(backend,frontend): fix boolean filter syntax and design tokens
• feat(frontend): add multi-cloud provider badges and flags for gke and azure
• fix(k8s): retry cloud OAuth token minting on corporate proxy SSL interception
• feat(k8s): support pure-Python GCP and Azure OAuth token generation with fallback
• fix(#202): deterministic Multus DaemonSet selection + document the pod-count scope (self-review)
• fix(#202): count Multus pods in the DaemonSet's namespace so OpenShift reports correctly

v4.1.0-rc.1

Pre-release v4.1.0-rc.1

Target release: v4.1.0 (minor bump)
Branch: staging
Commit: 34b6f08

Commits since v4.0.0

• Merge pull request #208 from f5devcentral/feat/unified-cloud-k8s-access
• Merge pull request #203 from f5devcentral/fix/202-multus-openshift-namespace
• security(deps): bump js-yaml 4.3.1 -> 4.3.2 (P4 Security Audit npm HIGH)
• security(deps): bump gitpython 3.1.58 -> 3.1.59 (P4 Security Audit gate)
• security(trivy): suppress CVE-2026-56854 (x/crypto/ssh) until helm 3.22.0 stable
• Merge pull request #215 from f5devcentral/security/trivyignore-cve-2026-56854
• security(deps): bump js-yaml 4.3.1 -> 4.3.2 (P4 Security Audit npm HIGH)
• security(deps): bump gitpython 3.1.58 -> 3.1.59 (P4 Security Audit gate)
• security(trivy): suppress CVE-2026-56854 (x/crypto/ssh) until helm 3.22.0 stable
• fix(#208): fail closed on mismatched credential template + self-review nits
• fix(#202 review r1): shared ranked Multus DaemonSet picker; file the class follow-ups
• fix(k8s): load kubeconfig purely in-memory and isolate project credential templates
• fix(k8s): correct AKS AAD server app id and extract multi-cloud badge utilities
• fix(frontend): sync version to 4.0.0 in package-lock.json for npm audit
• chore(deps): bump GitPython to 3.1.59, mcp urllib3, and ignore CVE-2026-56854
• fix(deps): pin urllib3>=2.6.4 to remediate CVE-2026-21441
• chore(security): allowlist microsoft public azure cli client id in gitleaks
• fix(backend,frontend): fix boolean filter syntax and design tokens
• feat(frontend): add multi-cloud provider badges and flags for gke and azure
• fix(k8s): retry cloud OAuth token minting on corporate proxy SSL interception
• feat(k8s): support pure-Python GCP and Azure OAuth token generation with fallback
• fix(#202): deterministic Multus DaemonSet selection + document the pod-count scope (self-review)
• fix(#202): count Multus pods in the DaemonSet's namespace so OpenShift reports correctly

v4.0.1-rc.2

Pre-release v4.0.1-rc.2

Target release: v4.0.1 (patch bump)
Branch: staging
Commit: 2c6684b

Commits since v4.0.0

• Merge pull request #203 from f5devcentral/fix/202-multus-openshift-namespace
• security(deps): bump js-yaml 4.3.1 -> 4.3.2 (P4 Security Audit npm HIGH)
• security(deps): bump gitpython 3.1.58 -> 3.1.59 (P4 Security Audit gate)
• security(trivy): suppress CVE-2026-56854 (x/crypto/ssh) until helm 3.22.0 stable
• Merge pull request #215 from f5devcentral/security/trivyignore-cve-2026-56854
• security(deps): bump js-yaml 4.3.1 -> 4.3.2 (P4 Security Audit npm HIGH)
• security(deps): bump gitpython 3.1.58 -> 3.1.59 (P4 Security Audit gate)
• security(trivy): suppress CVE-2026-56854 (x/crypto/ssh) until helm 3.22.0 stable
• fix(#202 review r1): shared ranked Multus DaemonSet picker; file the class follow-ups
• fix(#202): deterministic Multus DaemonSet selection + document the pod-count scope (self-review)
• fix(#202): count Multus pods in the DaemonSet's namespace so OpenShift reports correctly

v4.0.1-rc.1

Pre-release v4.0.1-rc.1

Target release: v4.0.1 (patch bump)
Branch: staging
Commit: 5e9ee00

Commits since v4.0.0

• Merge pull request #215 from f5devcentral/security/trivyignore-cve-2026-56854
• security(deps): bump js-yaml 4.3.1 -> 4.3.2 (P4 Security Audit npm HIGH)
• security(deps): bump gitpython 3.1.58 -> 3.1.59 (P4 Security Audit gate)
• security(trivy): suppress CVE-2026-56854 (x/crypto/ssh) until helm 3.22.0 stable

v4.0.0

v4.0.0 — major bump

⚠️ Breaking Changes

• Integrate #177 follow-up stack: #179 #180 #181 #182 #183 #186 #188 (#193)
  BREAKING CHANGE: MCP_SERVICE_PASSWORD is now required — the backend SystemExits under ENVIRONMENT=staging|production when it is unset or a known default; the shipped admin/changeme default is removed and rotated out on upgrade; the dist bundle renames MCP_USERNAME/MCP_PASSWORD to MCP_SERVICE_USERNAME/MCP_SERVICE_PASSWORD; and the Helm chart ships mcpUsername=mcp with a generated mcpPassword instead of admin/changeme.

• Container runner hardening: non-root gate bypass, outputs_file traversal, secret leaks, destroy/action time limits (#2)
  BREAKING CHANGE, called out deliberately. This also refuses named users — USER nonroot, the distroless convention, must become USER 65532. That is the point: a name cannot be resolved to a uid without the image's own /etc/passwd, so USER toor mapped to uid 0 previously sailed through the gate that exists to stop exactly that, and it was documented as a known gap rather than fixed. The Kubernetes substrate already enforces this (runAsNonRoot is kubelet-checked against a resolved numeric uid), so the two backends now agree instead of disagreeing on the same security property. The rejection message says what to change. A pre-existing test asserting named users pass was rewritten to assert the new behaviour, with the cost recorded in its docstring rather than deleted.

• Merge pull request #198 from f5devcentral/staging

• Integrate #177 follow-up stack: #179 #180 #181 #182 #183 #186 #188 (#193)

• Merge pull request #177 from f5devcentral/staging

• Version derivation and release notes must read commit bodies (→ 4.0.0) (#178)

• Redact bnk_config from the instance-wide global cluster list (#174)

• test: hold the Login loading-state request open without a live timer (#163)

• fix: give every MCP tool result one universal outcome key (ok) (#66) (#173)

• Surface backend error code/details as JSON fields, not a Python repr (#166)

• f5spkegress create template emits the current snatType/pseudoCNIConfig shape (#171)

• fix: warn (per-project) when sync deactivates a still-pinned module version (#170)

• Mount DriftDetailPanel in the drift-check dialog so Reconcile is reachable (#169)

• test: reset the reachability circuit-breaker registry between tests (#168)

• Scope KubernetesCluster name uniqueness to (project_id, name) (#167)

• fix: skip blueprint auto-sync when the linked blueprint source is inactive (#165)

• fix: record the failure cause as the state-transition reason (#164)

• Make the staging auto-close parser accept the PR template's own form (#158)

• Resolve the registry-host allowlist fail-closed at runtime, same as ingest (#162)

• Container-runner hardening remainder: cluster ownership, mount_path, route hygiene (#161)

• Make container (and every engine's) step output discoverable from the module (#159)

• RunModuleActionDialog: submit re-guard, reports invalidation on completion, escaping guards (#160)

• Set secret-file mode via fchmod on the open descriptor, not chmod by path (#157)

• Restore @pytest.mark.unit on TestRootUserGate; guard this file against it recurring (#156)

• Derive container time limits from the canonical step-set (#155)

• Stop SSOAuthDialog updating state after unmount; mock the real endpoint (#152)

• Never delete an interrupted-apply module without attempting a destroy (#151)

• Verify TLS on SSH-tunnelled clusters via tls-server-name (#150)

• Require an agent-class token on the benchmark ingest/register endpoints (#149)

• Bind the benchmark agent WS token to the agent identity (#41 F5) (#142)

• Report the flashed DPU's allocated tmfifo address, not a constant (#147)

• Resolve path-only module references through one canonical ordering (#146)

• Reset modules stuck in a transient state when their worker dies (#145)

• Release the helm advisory lock even from an aborted transaction (#144)

• Contain a failed initial blueprint sync in a SAVEPOINT (#143)

• Enforce risk_class at runtime for destructive MCP tools (#141)

• Destroy cli-bnkctl modules from the applied config, not the current form (#140)

• Pair the dist proxy conf with an unprivileged container port mapping (#139)

• Package the dist tarball from the tracked set, not the working tree (#138)

• Refuse project deletion while modules still own cloud resources (#129)

• Narrow the dist/nginx un-ignore rule to the two tracked confs (#132)

• Run the 746 integration tests CI never executed (#131)

• Container runner hardening: non-root gate bypass, outputs_file traversal, secret leaks, destroy/action time limits (#2)

• Merge pull request #126 from f5devcentral/fix/v2152-regression-test

• Merge pull request #123 from f5devcentral/fix/container-runner-hardening-2

• Merge pull request #1 from f5devcentral/fix/module-lifecycle-control

• docs: record the residual adoption race rather than shipping an unverified mitigation

• self-review fix: the derived-host patterns refused real provider endpoints

• self-review fix: a scratch-database failure must not skip past the required-tests guard

• review fixes: adopt in-flight destroys into the run, resolve the substrate, filter rather than raise

• fix(ci): scope the migration-test guard to its own job, and exclude the directory from the legacy suite

• review fixes: one canonical step resolver, canonical host comparison, derived-host constraint

• review fixes: give the migration tests their own database, and stop the CI step skipping silently

• safety: refuse to run the migration regression tests against a non-disposable database

• test: pin the v2_152 unique-index invariant, and correct its downgrade comment

• style: fix import ordering in the new hardening tests (ruff I001)

• review fixes: kill on the worker, scope from the executing run, fail closed on unknown scope, gate at the chokepoint

• review fixes: unconditional credential clearing, scoped egress, precise collision check, scalar check at the render point

• test: pin the invariant that a project destroy still tears down DISABLED modules

• review fix: clear EVERY credential family on a registry host change, not just basic-auth

• style: split multi-statement lines flagged by ruff (E702)

• fix(container-runner): registry credential exfil, deny-all egress, non-scalar action inputs, secret_files collision

• Merge remote-tracking branch 'f5dc/staging' into ci-fix/pr1

• Merge pull request #122 from f5devcentral/fix/v2152-unique-index-guard

• fix(migrations): stop v2_152 dropping the unique index on container_registries.name

• Merge remote-tracking branch 'f5dc/staging' into ci-fix/pr1

• Merge pull request #121 from f5devcentral/fix/restore-mirror-dropped-files

• fix(mirror): restore files the public export silently dropped, and fix the rules that dropped them

• review fixes: close three more enabled bypasses, fix the cancel guard regression, truncate on bytes

• fix: module lifecycle control — destroy blast radius, disabled gating, real cancel, step output

• chore: integration branch snapshot (internal origin/staging)

v4.0.0-rc.1

Pre-release v4.0.0-rc.1

Target release: v4.0.0 (major bump)
Branch: staging
Commit: ab2916c

Commits since v3.1.6

⚠️ Breaking Changes

• Integrate #177 follow-up stack: #179 #180 #181 #182 #183 #186 #188 (#193)
  BREAKING CHANGE: MCP_SERVICE_PASSWORD is now required — the backend SystemExits under ENVIRONMENT=staging|production when it is unset or a known default; the shipped admin/changeme default is removed and rotated out on upgrade; the dist bundle renames MCP_USERNAME/MCP_PASSWORD to MCP_SERVICE_USERNAME/MCP_SERVICE_PASSWORD; and the Helm chart ships mcpUsername=mcp with a generated mcpPassword instead of admin/changeme.

• Container runner hardening: non-root gate bypass, outputs_file traversal, secret leaks, destroy/action time limits (#2)
  BREAKING CHANGE, called out deliberately. This also refuses named users — USER nonroot, the distroless convention, must become USER 65532. That is the point: a name cannot be resolved to a uid without the image's own /etc/passwd, so USER toor mapped to uid 0 previously sailed through the gate that exists to stop exactly that, and it was documented as a known gap rather than fixed. The Kubernetes substrate already enforces this (runAsNonRoot is kubelet-checked against a resolved numeric uid), so the two backends now agree instead of disagreeing on the same security property. The rejection message says what to change. A pre-existing test asserting named users pass was rewritten to assert the new behaviour, with the cost recorded in its docstring rather than deleted.

• Integrate #177 follow-up stack: #179 #180 #181 #182 #183 #186 #188 (#193)

• Version derivation and release notes must read commit bodies (→ 4.0.0) (#178)

• Redact bnk_config from the instance-wide global cluster list (#174)

• test: hold the Login loading-state request open without a live timer (#163)

• fix: give every MCP tool result one universal outcome key (ok) (#66) (#173)

• Surface backend error code/details as JSON fields, not a Python repr (#166)

• f5spkegress create template emits the current snatType/pseudoCNIConfig shape (#171)

• fix: warn (per-project) when sync deactivates a still-pinned module version (#170)

• Mount DriftDetailPanel in the drift-check dialog so Reconcile is reachable (#169)

• test: reset the reachability circuit-breaker registry between tests (#168)

• Scope KubernetesCluster name uniqueness to (project_id, name) (#167)

• fix: skip blueprint auto-sync when the linked blueprint source is inactive (#165)

• fix: record the failure cause as the state-transition reason (#164)

• Make the staging auto-close parser accept the PR template's own form (#158)

• Resolve the registry-host allowlist fail-closed at runtime, same as ingest (#162)

• Container-runner hardening remainder: cluster ownership, mount_path, route hygiene (#161)

• Make container (and every engine's) step output discoverable from the module (#159)

• RunModuleActionDialog: submit re-guard, reports invalidation on completion, escaping guards (#160)

• Set secret-file mode via fchmod on the open descriptor, not chmod by path (#157)

• Restore @pytest.mark.unit on TestRootUserGate; guard this file against it recurring (#156)

• Derive container time limits from the canonical step-set (#155)

• Stop SSOAuthDialog updating state after unmount; mock the real endpoint (#152)

• Never delete an interrupted-apply module without attempting a destroy (#151)

• Verify TLS on SSH-tunnelled clusters via tls-server-name (#150)

• Require an agent-class token on the benchmark ingest/register endpoints (#149)

• Bind the benchmark agent WS token to the agent identity (#41 F5) (#142)

• Report the flashed DPU's allocated tmfifo address, not a constant (#147)

• Resolve path-only module references through one canonical ordering (#146)

• Reset modules stuck in a transient state when their worker dies (#145)

• Release the helm advisory lock even from an aborted transaction (#144)

• Contain a failed initial blueprint sync in a SAVEPOINT (#143)

• Enforce risk_class at runtime for destructive MCP tools (#141)

• Destroy cli-bnkctl modules from the applied config, not the current form (#140)

• Pair the dist proxy conf with an unprivileged container port mapping (#139)

• Package the dist tarball from the tracked set, not the working tree (#138)

• Refuse project deletion while modules still own cloud resources (#129)

• Narrow the dist/nginx un-ignore rule to the two tracked confs (#132)

• Run the 746 integration tests CI never executed (#131)

• Container runner hardening: non-root gate bypass, outputs_file traversal, secret leaks, destroy/action time limits (#2)

• Merge pull request #126 from f5devcentral/fix/v2152-regression-test

• Merge pull request #123 from f5devcentral/fix/container-runner-hardening-2

• Merge pull request #1 from f5devcentral/fix/module-lifecycle-control

• docs: record the residual adoption race rather than shipping an unverified mitigation

• self-review fix: the derived-host patterns refused real provider endpoints

• self-review fix: a scratch-database failure must not skip past the required-tests guard

• review fixes: adopt in-flight destroys into the run, resolve the substrate, filter rather than raise

• fix(ci): scope the migration-test guard to its own job, and exclude the directory from the legacy suite

• review fixes: one canonical step resolver, canonical host comparison, derived-host constraint

• review fixes: give the migration tests their own database, and stop the CI step skipping silently

• safety: refuse to run the migration regression tests against a non-disposable database

• test: pin the v2_152 unique-index invariant, and correct its downgrade comment

• style: fix import ordering in the new hardening tests (ruff I001)

• review fixes: kill on the worker, scope from the executing run, fail closed on unknown scope, gate at the chokepoint

• review fixes: unconditional credential clearing, scoped egress, precise collision check, scalar check at the render point

• test: pin the invariant that a project destroy still tears down DISABLED modules

• review fix: clear EVERY credential family on a registry host change, not just basic-auth

• style: split multi-statement lines flagged by ruff (E702)

• fix(container-runner): registry credential exfil, deny-all egress, non-scalar action inputs, secret_files collision

• Merge remote-tracking branch 'f5dc/staging' into ci-fix/pr1

• Merge pull request #122 from f5devcentral/fix/v2152-unique-index-guard

• fix(migrations): stop v2_152 dropping the unique index on container_registries.name

• Merge remote-tracking branch 'f5dc/staging' into ci-fix/pr1

• Merge pull request #121 from f5devcentral/fix/restore-mirror-dropped-files

• fix(mirror): restore files the public export silently dropped, and fix the rules that dropped them

• review fixes: close three more enabled bypasses, fix the cancel guard regression, truncate on bytes

• fix: module lifecycle control — destroy blast radius, disabled gating, real cancel, step output

• chore: integration branch snapshot (internal origin/staging)

v3.1.7-rc.9

Pre-release v3.1.7-rc.9

Target release: v3.1.7 (patch bump)
Branch: staging
Commit: 009840a

Commits since v3.1.6

• Redact bnk_config from the instance-wide global cluster list (#174)
• test: hold the Login loading-state request open without a live timer (#163)
• fix: give every MCP tool result one universal outcome key (ok) (#66) (#173)
• Surface backend error code/details as JSON fields, not a Python repr (#166)
• f5spkegress create template emits the current snatType/pseudoCNIConfig shape (#171)
• fix: warn (per-project) when sync deactivates a still-pinned module version (#170)
• Mount DriftDetailPanel in the drift-check dialog so Reconcile is reachable (#169)
• test: reset the reachability circuit-breaker registry between tests (#168)
• Scope KubernetesCluster name uniqueness to (project_id, name) (#167)
• fix: skip blueprint auto-sync when the linked blueprint source is inactive (#165)
• fix: record the failure cause as the state-transition reason (#164)
• Make the staging auto-close parser accept the PR template's own form (#158)
• Resolve the registry-host allowlist fail-closed at runtime, same as ingest (#162)
• Container-runner hardening remainder: cluster ownership, mount_path, route hygiene (#161)
• Make container (and every engine's) step output discoverable from the module (#159)
• RunModuleActionDialog: submit re-guard, reports invalidation on completion, escaping guards (#160)
• Set secret-file mode via fchmod on the open descriptor, not chmod by path (#157)
• Restore @pytest.mark.unit on TestRootUserGate; guard this file against it recurring (#156)
• Derive container time limits from the canonical step-set (#155)
• Stop SSOAuthDialog updating state after unmount; mock the real endpoint (#152)
• Never delete an interrupted-apply module without attempting a destroy (#151)
• Verify TLS on SSH-tunnelled clusters via tls-server-name (#150)
• Require an agent-class token on the benchmark ingest/register endpoints (#149)
• Bind the benchmark agent WS token to the agent identity (#41 F5) (#142)
• Report the flashed DPU's allocated tmfifo address, not a constant (#147)
• Resolve path-only module references through one canonical ordering (#146)
• Reset modules stuck in a transient state when their worker dies (#145)
• Release the helm advisory lock even from an aborted transaction (#144)
• Contain a failed initial blueprint sync in a SAVEPOINT (#143)
• Enforce risk_class at runtime for destructive MCP tools (#141)
• Destroy cli-bnkctl modules from the applied config, not the current form (#140)
• Pair the dist proxy conf with an unprivileged container port mapping (#139)
• Package the dist tarball from the tracked set, not the working tree (#138)
• Refuse project deletion while modules still own cloud resources (#129)
• Narrow the dist/nginx un-ignore rule to the two tracked confs (#132)
• Run the 746 integration tests CI never executed (#131)
• Container runner hardening: non-root gate bypass, outputs_file traversal, secret leaks, destroy/action time limits (#2)
• Merge pull request #126 from f5devcentral/fix/v2152-regression-test
• Merge pull request #123 from f5devcentral/fix/container-runner-hardening-2
• Merge pull request #1 from f5devcentral/fix/module-lifecycle-control

v3.1.7-rc.8

Pre-release v3.1.7-rc.8

Target release: v3.1.7 (patch bump)
Branch: staging
Commit: 5755bdf

Commits since v3.1.6

• Make the staging auto-close parser accept the PR template's own form (#158)
• Resolve the registry-host allowlist fail-closed at runtime, same as ingest (#162)
• Container-runner hardening remainder: cluster ownership, mount_path, route hygiene (#161)
• Make container (and every engine's) step output discoverable from the module (#159)
• RunModuleActionDialog: submit re-guard, reports invalidation on completion, escaping guards (#160)
• Set secret-file mode via fchmod on the open descriptor, not chmod by path (#157)
• Restore @pytest.mark.unit on TestRootUserGate; guard this file against it recurring (#156)
• Derive container time limits from the canonical step-set (#155)
• Stop SSOAuthDialog updating state after unmount; mock the real endpoint (#152)
• Never delete an interrupted-apply module without attempting a destroy (#151)
• Verify TLS on SSH-tunnelled clusters via tls-server-name (#150)
• Require an agent-class token on the benchmark ingest/register endpoints (#149)
• Bind the benchmark agent WS token to the agent identity (#41 F5) (#142)
• Report the flashed DPU's allocated tmfifo address, not a constant (#147)
• Resolve path-only module references through one canonical ordering (#146)
• Reset modules stuck in a transient state when their worker dies (#145)
• Release the helm advisory lock even from an aborted transaction (#144)
• Contain a failed initial blueprint sync in a SAVEPOINT (#143)
• Enforce risk_class at runtime for destructive MCP tools (#141)
• Destroy cli-bnkctl modules from the applied config, not the current form (#140)
• Pair the dist proxy conf with an unprivileged container port mapping (#139)
• Package the dist tarball from the tracked set, not the working tree (#138)
• Refuse project deletion while modules still own cloud resources (#129)
• Narrow the dist/nginx un-ignore rule to the two tracked confs (#132)
• Run the 746 integration tests CI never executed (#131)
• Container runner hardening: non-root gate bypass, outputs_file traversal, secret leaks, destroy/action time limits (#2)
• Merge pull request #126 from f5devcentral/fix/v2152-regression-test
• Merge pull request #123 from f5devcentral/fix/container-runner-hardening-2
• Merge pull request #1 from f5devcentral/fix/module-lifecycle-control
• docs: record the residual adoption race rather than shipping an unverified mitigation
• self-review fix: the derived-host patterns refused real provider endpoints
• self-review fix: a scratch-database failure must not skip past the required-tests guard
• review fixes: adopt in-flight destroys into the run, resolve the substrate, filter rather than raise
• fix(ci): scope the migration-test guard to its own job, and exclude the directory from the legacy suite
• review fixes: one canonical step resolver, canonical host comparison, derived-host constraint
• review fixes: give the migration tests their own database, and stop the CI step skipping silently
• safety: refuse to run the migration regression tests against a non-disposable database
• test: pin the v2_152 unique-index invariant, and correct its downgrade comment
• style: fix import ordering in the new hardening tests (ruff I001)
• review fixes: kill on the worker, scope from the executing run, fail closed on unknown scope, gate at the chokepoint